Monitoring the existence of or changes to Domain User Accounts.
https://d3fend.mitre.org/technique/d3f:DomainAccountMonitoring/